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[57] ABSTRACT 

A backup software program is installed in an isolated 
portion in the memory of at least one of redundant 
computers. The backup program performs basically the 
same functions as the prime program but is dissimilarly 
programmed to prevent a common software error. 
Switchover to the backup program occurs either auto- 
matically in response to monitors, or manually by the 
operator (i.e. pilot) when he detects an anomaly. 

10 Claims, 2 Drawing Sheets 
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BACKUP CONTROL SYSTEM (BUCS) 

The invention described herein was made in the per- 
formance of work under NASA Contract No. NAS2- 5 
11771 and is subject to the provisions of Section 305 of 
the National Aeronautics and Space Act of 1958 (72 
Stat 435; 42 U.S.C. 2457). S-3777 

CROSS REFERENCE TO RELATED 10 

APPLICATION 

The invention described herein may employ some of 
the teachings disclosed and claimed in a commonly 
owned co-pending application filed on Oct. 24, 1986 by 
Tulpule et al, Ser. No. 922,617, entitled A RELIABLE, 15 
INDEPENDENT, BACKUP MODE TRANSFER 
MECHANISM FOR DIGITAL CONTROL COM- 
PUTERS. 


TECHNICAL FIELD 20 

The invention relates to techniques for responding to 
software errors, especially in life critical systems such as 
aircraft control. 

BACKGROUND OF THE INVENTION . 25 

Continued proper operation of a digital system fol- 
lowing a software fault is highly desirable in modem 
computer systems and becomes mandatory in a life 
critical digital system, such as those employed in air- 
craft primary flight control systems. A software error 30 
may manifest itself by the processor becoming mired 
within the program and not completing its tasks, or by 
the processor completing its tasks too rapidly by not 
executing all of its program. Redundant hardware and 
voting schemes provide hardware fault protection but 35 
do not provide safeguards against software faults when 
the redundant computers are programmed with identi- 
cal software. Thus, each of the redundant channels can 
suffer the same software fault, at virtually the same 
instant. The present state of the art in software verifica- 40 
tion and validation does not provide any tool or tech- 
nique which can guarantee the absence of software 
faults; on the contrary, experience has shown that soft- 
ware errors continue to. exist even in exhaustively veri- 
fied and validated software. 45 

Backup systems have been provided by simple analog 
systems, additional digital systems which are dissimi- 
larly programmed, or by mechanical means. Reversion 
to these backups generally occurs following disagree- 
ment between the redundant channels of the prime 50 
digital system. These backup systems require significant 
additional hardware with the attendant disadvantages 
of cost, weight, power demand and heat dissipation. 
The analog and mechanical backups are additionally 
constrained to be simple derivatives of the usually 55 
highly complex and nonlinear implementation of the 
prime digital system. 

DISCLOSURE OF THE INVENTION 

It is an object of the invention to provide a means of 60 
continuing the proper operation of a digital computer 
system in the presence of a software error with minimal 
additional hardware. 

According to the invention, a backup software pro- 
gram is installed in an isolated portion in the memory of 65 
at least one of the redundant computers. The second 
program performs basically the same functions as the 
prime program but is dissimilarly programmed to avoid 
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a common software error. Switchover to the second 
program occurs either automatically, or manually by 
the operator (i.e. pilot) when he detects an anomaly. 
Automatic switchover is initiated when at least n-1 (in a 
system having n levels of redundancy) computer moni- 
tors indicate a software fault condition. The computer 
monitors may be duty cycle timers which detect a com- 
puter cycling improperly (too long or too short), rea- 
sonableness testers, analog comparision models, or a 
combination of these types. Complexity and sophistica- 
tion of the monitors will vary for particular applications 
but, in general, the monitors must be implemented in 
hardware to preclude their being rendered ineffective 
by the common software faults they are intended to 
discover. The assembler or compiler used to assemble/- 
compile the backup mode program is also dissimilarly 
programmed to eliminate possible assembler/compiler 
faults as a source of common mode software faults. 

Other objects, features, and advantages of the inven- 
tion will become more apparent in light of the following 
description thereof. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram of a control system employ- 
ing the invention; 

FIG. 2 is a schematic of a monitor for the invention; 

FIG. 3 is a block diagram detailing a portion of the 
invention 

BEST MODE FOR CARRYING OUT THE 
INVENTION 

In FIG. 1 is shown a computer based control system 
(10) having four computer channels A-D. Each channel 
has a processor section 12, associated input/output 
hardware 14, and memory 16. The memory 16 is di- 
vided into two portions. A portion 18 contains primary 
software which is accessed during normal system oper- 
ation. A portion 20 contains dissimilar backup software, 
and is accessed only upon failure of the primary soft- 
ware. A monitor 22, is operable to determine failure of 
the primary software. The monitor 22 is, for example, a 
duty cycle timer, reasonableness tester, or analog com- 
parison model. 

The four channels A-D are redundant; that is, each 
contains copies of the primary and backup software in 
their respective memories 16. The computer system 10 
implements a voting scheme in either hardware or soft- 
ware, such as is known, to output the most appropriate 
selected signal to a controlled device 24, such as the 
control surface actuators of an aircraft, in response to 
inputs 26, such as signals from a pilot or sensors. It 
should be understood that the invention is applicable to 
any number of channels, and that the backup software 
could be installed in only one channel. 

FIG. 2 details a typical monitor 22 used in each chan- 
nel of the computer system 10, for instance the channel 
A, which is representative of the monitors 22 in chan- 
nels B, C, and D. An OR gate 30A (the “A” suffix 
indicates association with channel A) is responsive to 
signals from a watchdog timer 32A, a short duty cycle 
timer 34A, and a signal on a line 36A, indicative of other 
protective conditions; any of which will cause the OR 
gate 30 A to provide a signal on a line 40 A that will shut 
down the power to channel A. A relay 42A for the 
channel A trips in response to the signal on the line 40A 
to shut down the channel A. Similar OR gates 30B-30D 
and relays 42B-42D are provided for the other channels 
B-D. The switching logic for the monitors 22 should be 
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implemented in hardware so that they are independent 
of software faults. 

A switching section 44A includes two contact sets 
46A-46D, 48A-48D from each relay 42A-42D, ar- 
ranged as shown so that any three channel failures will 5 
generate a signal on a line 49 A to an AND circuit 50 A. 

Another switching section 52A includes a third 
contact set 54A-54D from each relay 42A-42D ar- 
ranged in parallel so that the failure of any one channel 
starts a timer, $uch as an integrator 56A driving a com- 10 
parator 58A, so that until a predetermined interval of 
time (Trej) has elapsed, indicative of the time within 
which a common mode software failure would be expe- 
rienced in all channels, an enable signal is provided to 
the AND circuit 50 A* (The timer 56 A may be reset for 15 
conditions such as rotor brake “ON”.) If it is judged 
that a common mode failure is not a near simultaneous 
event, then T re /can be set to infinity. This will permit 
the backup software to be engaged whenever n — 1 out ^ 
of n severs occur. 

The AND circuit 50A is only responsive to the sig- 
nals from the switching section 44A and the comparator 
58A to provide a signal on a line 60 when the flight 
critical system is active (such as might be sensed by a 
rotor brake release signal in a helicopter embodiment) 
as indicated by a signal on a line 61 (common to all 
channels A-D). 

A switching section 64A includes a contact set 
66A-66D from each relay 42A-42D arranged in series 
so that a signal is output on a line 68A in response to a 
software failure in all four channels A-D. 

An OR gate 70A is responsive to the output of the 
AND gate 50A and to the output of the switching sec- 
tion 64A to provide a signal on a line 72A which will 35 
initiate the backup mode of operation based on either 
contingency. The signal on the line 12 A is also provided 
in response to a manual override signal on a line 73 to 
the OR gate 70A. 

The signal on the line 72A will proceed to the chan- 4Q 
nel A as a nonmaskable hardware interrupt signal on a 
line 73A if an AND circuit 74A is armed by an arming 
signal on a line 76A to its input. The nonmaskable hard- 
ware interrupt request is issued to each channel A-D, 
whereupon the CPU 12 will complete whatever instruc- 45 
tion it is currently executing before acknowledging the 
nonmaskable interrupt. The hardware transfer logic 
will respond to the nonmaskable interrupt by switching 
to the backup memory bank. The CPU will then begin 
“servicing the interrupt” at the prescribed memory 50 
location in the backup memory. The interrupt service 
routine in this case will actually be the backup software. 
This switchover logic accomplishes a unified switch- 
over of the processor at a known processor state and to 
a known location in the backup memory. It is necessary 55 
that the backup system reinitialize the system, for in- 
stance by reinitializing. Suspect fault conditions could 
also be reset, since they could be faulty indications of 
the malfunctionary software. It is also desirable to syn- 
chronize the commands computed to actuator positions 60 
(in an aircraft) to minimize transients, and then blend 
over a period of time to the backup memory commands. 

In a system such as an aircraft control system, the 
backup software can be a simplified control law. Gener- 
ally, the simpler the control law is, the easier it is to 65 
verify and validate. The backup software can be in- 
stalled in all of the computers, but it may be preferable 
to install it in only one, thereby avoiding voting 
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schemes and other complications in the event of switch- 
over to the backup software. 

The backup system requires limited additional input- 
/output interfaces, digital logic circuitry, and new soft- 
ware for each channel that it is installed in. 

When the pilot arms the Backup Mode (76A), the 
FCS (Flight Control System) will continue to operate 
in the normal mode until any one or more of the follow- 
ing conditions occur: 

1. The pilot initiates a backup transfer. 

2. n— 1 control system channels output “sever” within 
the prescribed time interval T re /. 

3. n control system channels output sever. 

The Backup mode transfer logic selects from the 
aforementioned condition list any active requesting 
condition signal to drive a nonmaskable interrupt re- 
quest to the processor(s) in the channel. The reaction to 
the nonmaslible interrupt can be thought of as causing 
a jam transfer to the backup memory for instructions. 
The same transfer process will be separately occurring 
in the other channels. 

With reference to FIG. 3, each channel will respond 
to the NMI via a hardware interrupt 80 which will 
cause the following sequential actions to occur: 

1. The memory bank will be switched from the prime 
memory bank 82 to the backup memory bank 84; 

2. The proper starting address of the backup software 
(residing in the backup memory bank) will be trans- 
ferred into program counter 86; and 

3. The CPU 88 will execute its next instruction from the 
starting address of the backup program now stored in 
the program counter. 

We claim: 

1. In a computer system (10) having a plurality of 
identical processors (12) and controlling a device (24), a 
method of providing control over the device compris- 
ing: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
(12), said primary software directing the operation 
of the processors to control the device during nor- 
mal operation; 

installing backup software, dissimilar from the pri- 
mary software, in an isolated portion (20) of mem- 
ory (16) associated with at least one of the proces- 
sors (12), said backup software capable of directing 
the operation of the processor(s) to control the 
device of in the event of a sensed event; 
sensing for a fault event occurring in the primary 
software affecting all processors; 
sensing for a fault event occurring in the primary 
software affecting a majority of the processors (12); 
sensing for an externally initiated event represented 
by a backup software transfer command signal; 
providing a nonmaskable interrupt request in re- 
sponse to one of said sensed events; 
completing whatever instruction is being executed in 
the primary software when the nonmaskable inter- 
rupt request is provided, and then acknowledging 
the nonmaskable interrupt request; and 
disabling the primary software and executing the 
backup software in response to the nonmaskable 
interrupt request so as to maintain control over the 
device with the backup software associated with 
the at least one processor. 

2. A method according to claim 1, comprising jam- 
transferring to the isolated portion of memory in re- 
sponse to the sensed fault. 
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3. A method according to claim 1 wherein the backup 
software is simpler than the primary software. 

4. In a computer system (10) having at least two iden- 
tical processors (12) and controlling a device (24), a 
method of providing control over the device compris- 5 
mg: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
( 12 ), said primary software directing the operation 
of the processors to control the device during nor- 10 
mal operation; 

installing backup software, dissimilar from the pri- 
mary software, in an isolated portion ( 20 ) of mem- 
ory (16) associated with at least one of the proces- 
sors (12), said backup software capable of directing 15 
the operation of the processor^) to control the 
device in the event of a sensed fault in the primary 
software affecting all processors; 
enabling a nonmaskable interrupt request circuit; 
sensing the fault in the primary software affecting all 20 
processors; 

providing a nonmaskable interrupt request in re- 
sponse to th$ sensed fault; 

completing whatever instruction is being executed in 
the primary software when the nonmaskable inter- 25 
rupt request is provided, and then acknowledging 
the nonmaskable interrupt request; and 
disabling the primary software and executing the 
backup software in response to the nonmaskable 
interrupt request so as to maintain control over the 30 
device with the backup software associated with 
the at least one processor. 

5. In a computer system (10) having a plurality of 
identical processors (12) and controlling a device (24), a 
method of providing control over the device compris- 35 
mg: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
( 12 ), said primary software directing the operation 
of the processors to control the device during nor- 40 
mal operation: 

installing backup software, dissimilar from the pri- 
mary software, in an isolated portion ( 20 ) of mem- 
ory (16) associated with at least one of the proces- 
sors (12), said backup software capable of directing 45 
the operation of the processors^) to control the 
device in the event of a sensed fault in the primary 
software affecting a*majority of the processors; 
sensing a first to occur fault in the primary software 
affecting any one or more of the processors; 50 
providing a transfer enable signal for a selected per- 
iod after sensing said fault in said one or more of 
the processors; 

sensing said fault in the primary software affecting a 
majority of the processors and providing a transfer 55 
signal for so long as said fault persists; 
providing a nonmaskable interrupt request in re- 
sponse to the sensed fault only if said transfer signal 
occurs concurrently with said enable signal; 
completing whatever instruction is being executed in 60 
the primary software when the nonmaskable inter- 
rupt request is provided, and then acknowledging 
the nonmaskable interrupt request; and 
disabling the primary software and executing the 
backup software in response to the nonmaskable 65 
interrupt request so as to maintain control over the 
device with the backup software associated with 
the at least one processor. 
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6. A method of providing control over a device (24) 
by means of a computer system (10) having a plurality 
of identical processors (12), comprising the steps of: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
(12), said primary software in each channel’s mem- 
ory (18) for directing the operating of its associated 
processor to control the device; 

installing backup software, dissimilar from said pri- 
mary software, in a portion (20) of said memory 
(16) in at least one of the processors (12), said 
backup software protected by hardware (80) from 
access by said primary software, said backup soft- 
ware for directing the operation of the processor(s) 
to control the device (24) in the event of a sensed 
fault in said primary software affecting the proces- 
sors; 

sensing, by means of a window timer, a fault in said 
primary software affecting the processors (12) and 
providing a fault signal indicative thereof; and 

disabling, in response to said fault signal, said primary 
software and activating said backup software so as 
to maintain control over the device (24) with said 
backup software. 

7. A method of providing control over a device (24) 
by means of a computer system (10) having a plurality 
of identical processors (12), comprising the steps of: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
(12), said primary software in each channel’s mem- 
ory (18) for directing the operating of its associated 
processor to control the device; 

installing backup software, dissimilar from said pri- 
mary software, in a portion (20) of said memory 
(16) in at least one of the processors (12), said 
backup software protected by hardware (80) from 
access by said primary software, said backup soft- 
ware for directing the operation of the processor(s) 
to control the device (24) in the event of a sensed 
fault in said primary software affecting the proces- 
sors; 

sensing, by means of hardware (22), for a fault event 
occurring in the primary software affecting a ma- 
jority of the processors (12) and sensing for an 
externally initiated event represented by a backup 
software transfer command signal and providing 
said fault signal in response to one of said sensed 
events; and 

disabling in response to said fault signal, said primary 
software and activating said backup software so as 
to maintain control over the device (24) with said 
backup software. 

8. A method of providing control over a device (24) 
by means of a computer system (10) having a plurality 
of identical processors (12), comprising the steps of: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
(12), said primary software in each channel’s mem- 
ory (18) for directing the operating of its associated 
processor to control the device; 

installing backup software, dissimilar from said pri- 
mary software, in a portion (20) of said memory 
(16) in at least one of the processors (12), said 
backup software protected by hardware (80) from 
access by said primary software, said backup soft- 
ware for directing the operation of the processor(s) 
to control the device (24) in the event of a sensed 
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fault in said primary software affecting the proces- 
sors; 

sensing by means of hardware (22), a fault in said 
primary software affecting the processors (12) and 
providing a fault signal in the form of a nonmaska- 5 
ble interrupt signal in response to the sensing of 
said fault in said primary software affecting the 
processors and wherein said step of disabling com- 
prises the step of jam transferring to said backup 
software in response to said nonmaskable interrupt 
signal; and 

disabling, in response to said fault signal, said primary 
software and activating said backup software so as 
to maintain control over the device (24) with said 
backup software. 

9. A method of providing control over a device (24) 
by means of a computer system (10) having a plurality 
of identical processors (12), comprising the steps of: 

installing identical primary software in a portion (18) 
of memory (16) associated with each processor 20 
(12), said primary software in each channel's mem- 
ory (18) for directing the operating of its associated 
processor to control the device; 

installing backup software, dissimilar from said pri- 
mary software, in a portion (20) of said memory 25 
(16) in at least one of the processors (12), said 
backup software protected by hardware (80) from 
access by said primary software, said backup soft- 
ware for directing the operation of the processor(s) 
to control the device (24) in the event of a sensed 30 
fault in said primary software affecting the proces- 
sors; 

sensing, by means of hardware (22), a first to occur 
fault in the primary software affecting any one or 
more of the processors (12) and providing a trans- 
fer enable signal for a selected period after sensing 
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said first fault event and providing a transfer re- 
quest in response to n-1 fault event if said n— 1 fault 
event; and 

disabling, in response to said fault signal, said primary 
software and activating said backup software so as 
to maintain control over the device (24) with said 
backup software. 

10. A method of providing control over a device (24) 
by means of a computer system (10) having a plurality 
10 of identical processors (12), comprising the steps of: 
installing identical primary software in a portion (18) 
of memory (16) associated with each processor 
(12), said primary software in each channel’s mem- 
ory (18) for directing the operating of its associated 
15 processor to control the device; 

installing backup software, dissimilar from said pri- 
mary software, in a portion (20) of said memory 
(16) in at least one of the processors (12), said 
backup software protected by hardware (80) from 
access by said primary software, said backup soft- 
ware for directing the operation of the processor(s) 
to control the device (24) in the event of a sensed 
fault in said primary software affecting the proces- 
sors; 

sensing, by means of hardware (22) a fault in said 
primary software affecting the processors (12) and 
providing a fault signal indicative thereof; and 
disabling, in response to said fault signal, said primary 
software and activating said backup software so as 
to maintain control over the device (24) with said 
backup software; 

wherein said backup software (20) in each channel 
are operated synchronously and said device (24) is 
controlled by means of synchronized command 

35 signals to control transients. 
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